Messages Reference Guide

24 Fabric OS Message Reference
53-1002749-01
Reading the system messages
1
Reading an Audit message
Compared to RASLog error messages, messages flagged as AUDIT provide additional user and
system-related information of interest for post-event auditing and troubleshooting the problem.
The following example shows the format of the Audit event message.
<Sequence Number> AUDIT, <timestamp>, [<Event ID>], <Severity>, <Event Class>,
<User ID>/<Role>/<IP address>/<Interface>/<Application Name>, <Admin
Domain>/<Switch name>, <Reserved field for future expansion>, <Event-specific
information>
The following is a sample Audit event message.
0 AUDIT, 2005/12/10-09:54:03, [SEC-1000], WARNING, SECURITY,
JohnSmith/root/192.0.2.2/Telnet/CLI, Domain A/JohnsSwitch, , Incorrect password
during login attempt.
Sequence Number The error message position in the log. When a new message is added to the
log, this number is incremented by 1.
The message sequence number starts at 1 after a firmwareDownload and will
increase up to a value of 2,147,483,647 (0x7ffffff).
The sequence number continues to increase after the message log wraps
around, i.e. the oldest message in the log is deleted when a new message is
added. The sequence number can be reset to 1 using the errClear command.
The sequence number is persistent across power cycles and switch reboots.
Flags For most messages, this field contains a space character (null value)
indicating that the message is neither an AUDIT or FFDC message. Messages
may contain the following values:
• FFDC – Indicates that additional first failure data capture information has
also been generated for this event.
• FID – The Fabric ID that can range from 0 to 128. FID 128 means the
message was generated by the default switch instance.
• CHASSIS – The message that was generated by the chassis instance.
• SLOT number – Indicates the message was generated from slot # blade
main CPU.
• SLOT #/1 – Indicates the message was generated from slot # blade
Co-CPU.
Severity Level The severity of the error, which can be one of the following:
• 1 – CRITICAL
• 2 – ERROR
• 3 – WARNING
• 4 – INFO
Switch name The defined switch name or the chassis name of the switch depending on the
action; for example, high availability (HA) messages typically show the chassis
name, and login failures show the logical switch name.
This value is truncated if it exceeds 16 characters in length. Run either the
chassisName command to name the chassis or the switchName command to
rename the logical switch.
Event-specific information A text string explaining the error encountered and providing parameters
supplied by the software at runtime.
TABLE 4 System message field description (Continued)
Variable name Description